Copy the content of auth attribute to another auth attribute
[wp_ad_camp_1]
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 | <OutputProcess id="tip-common-retrievesessionid"> <HandleCookie order="a4" name="JSESSIONID" attribute="value" findValue=".*" replaceValue="${auth:method=store,type=testtype,attribute=sessionid,value=${0}}" substituteFlag="true" matchCase="false"/> <HandleCookie order="a4" name="JSESSIONID_ibm_console_16310" attribute="value" findValue=".*" replaceValue="${auth:method=store,type=testtype,attribute=JSESSIONID_ibm_console_16310,value=${0}}" substituteFlag="true" matchCase="false"/> <EvaluateSubstitution order="a4" command="${auth:method=store,type=testtype,attribute=XSS, value=${auth:method=get,type=testtype, attribute=JSESSIONID_ibm_console_16310}}" substituteFlag="true"/> </OutputProcess> |
Result – XSS has the same value as JSESSIONID_ibm_console_16310
Geting a substring – using find and replace unique tokens
[wp_ad_camp_2]
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 | <OutputProcess id="tip-common-retrievesessionid"> <HandleCookie order="a4" name="JSESSIONID" attribute="value" findValue=".*" replaceValue="${auth:method=store,type=testtype,attribute=sessionid,value=${0}}" substituteFlag="true" matchCase="false"/> <HandleCookie order="a4" name="JSESSIONID_ibm_console_16310" attribute="value" findValue=".*" replaceValue="${auth:method=store,type=testtype,attribute=JSESSIONID_ibm_console_16310,value=${0}}" substituteFlag="true" matchCase="false"/> <SetVariable order="a4" name="XSS_TEM" findValue=".*" substituteFlag="true" replaceValue="${auth:method=get,type=testtype,attribute=JSESSIONID_ibm_console_16310}"/> <SetVariable order="a4" name="XSS_TEMP" findValue="0000" substituteFlag="true" replaceValue=""/> <SetVariable order="a4" name="XSS_TEMP" findValue=":-1" substituteFlag="true" replaceValue=""/> <EvaluateSubstitution order="a4" command="${auth:method=store,type=testtype,attribute=XSS,value=${var:XSS_TEMP}}" substituteFlag="true"/> </OutputProcess> |
XSS contains the substring of JSESSIONID_ibm_console_16310’s value
Assigning an auth attribute value to a class field – using class editor
[wp_ad_camp_3]
Assign value to a class field dynamically